Privacy notice
How Learn&Gain uses personal data, your choices and your rights.
1. Who we are
Learn&Gain is operated by Vision of Sustainability (VOS) BV, Belgium.
Registered address: Sloesveldstraat 18, 1560 Hoeilaart, Belgium
Company / VAT number: BE 0804.155.734
Privacy contact: privacy@learn-and-gain.com
For the processing described in this notice, VOS BV acts as the controller unless we expressly state otherwise.
2. What personal data we collect
Depending on how you use Learn&Gain, we may process:
- account and identity data, such as email address, account identifier and verification status;
- profile data, such as name, role, job function, company, experience level, country, city, gender, age range and selected infrastructure domain/segments;
- optional profile data, such as phone number, LinkedIn address and professional background, where you choose to provide them;
- challenge and activity data, including answers, participation history, streaks, timestamps and challenge preferences;
- reward and referral data, including points, reward events, referral codes and referral status;
- communication preferences, including daily-reminder consent and leaderboard consent;
- contact and feedback information, including free-text messages you submit;
- notification and delivery metadata;
- campaign and operational event data used to understand service use, performance and reliability;
- security and technical logs, which may include IP/network/request metadata and security events.
We ask you not to include unnecessary sensitive personal data in free-text fields.
3. Why we use your data and our legal bases
We process personal data only for defined purposes and on an appropriate legal basis.
Providing Learn&Gain
We use account, profile, challenge, activity and reward data to create and secure your account, deliver challenge functionality, personalize the experience and administer campaign rewards. Our primary basis is performance of the service relationship.
Daily reminders and public leaderboard
Daily reminder emails and public leaderboard participation are based on your consent. You can withdraw these choices through the relevant account preference. Withdrawal does not affect processing already carried out before withdrawal.
Contact and feedback
We use contact information and messages to respond to your request. Depending on the context, this may be necessary to take steps at your request before entering into a relationship or may rely on our legitimate interests in responding to enquiries and improving the service.
Service improvement, operations and security
We use minimized operational, feedback, notification and security data where necessary for legitimate interests, including service improvement, delivery troubleshooting, fraud/abuse prevention and security monitoring. Optional campaign analytics used to measure visits and interactions is kept separate and runs only when you consent to analytics through the privacy choices.
Referrals
At launch, Learn&Gain may support referral links and referral rewards. Under the approved launch position, Learn&Gain direct-email invitations to non-users remain disabled unless separately approved later. Users may share their referral link themselves. If direct-email referral functionality is enabled in the future, this notice and the underlying safeguards will be updated before activation.
4. Mandatory and optional information
Information needed to create an account and provide core functionality must be provided where marked as required. Optional fields remain optional and are not required merely to receive core Learn&Gain functionality.
5. How long we keep personal data
Our approved launch retention baseline is:
- account/profile and user activity: while active, then reviewed for deletion after 24 months of inactivity, subject to any earlier valid erasure request and applicable exceptions;
- ordinary challenge/reward records: generally up to 24 months after campaign/account closure, with longer retention only where a legal or accounting obligation applies;
- pending/unaccepted referral records: 90 days;
- qualified referral relationships: generally up to 24 months after qualification/campaign close;
- contact messages and question feedback: generally 24 months after resolution or last meaningful use;
- notification history: 12 months;
- granular campaign-event records: 12 months, after which only aggregated non-personal statistics may be retained where useful;
- ordinary application logs: target retention 90 days;
- security/audit logs: target retention 12 months where needed for security investigation or audit;
- Production backup and point-in-time-recovery copies: up to 35 days under the current recovery lifecycle.
Where a legal hold, dispute, fraud investigation or statutory obligation applies, a specific record may be kept longer than the normal period.
6. Who receives personal data
We use service providers to operate Learn&Gain. These currently include:
- Amazon Web Services (AWS) for infrastructure, identity, databases, application processing, content delivery, transactional email, logging, security and backup/recovery;
- GitHub for source control and deployment automation. GitHub is not an approved Production personal-data store, and we do not intentionally copy Production user datasets into repositories or CI/CD logs.
External services such as YouTube, LinkedIn or Instagram may process data under their own terms when you interact with their content or follow external links. We do not control the independent processing carried out by those services.
We do not sell your profile data.
7. International transfers
Some suppliers may process or support services from locations outside the European Economic Area. Where required, we rely on the supplier's applicable contractual and legal transfer safeguards. Our internal processor register is reviewed when new services are introduced or data flows materially change.
8. Learn&Gain and Infracademy
A future Learn&Gain → Infracademy handoff is not active under the current launch baseline. No live personal-data handoff or automatic shared-account creation is approved at this stage.
Before such a handoff is activated, we will define the exact data fields, purpose, legal role, lawful basis, retention and user-facing disclosure. This notice will be updated before activation if required.
9. Your rights
Subject to applicable conditions and exceptions, you may request:
- access to your personal data;
- correction of inaccurate data;
- erasure;
- restriction of processing;
- objection to processing based on legitimate interests;
- portability where applicable;
- withdrawal of consent where processing is based on consent.
For rights requests, contact privacy@learn-and-gain.com. We may need to verify your identity before acting on a request. We will not ask for your password, MFA secret, authentication token or one-time login code.
Learn&Gain uses a documented manual rights-request process at launch. If an erasure is completed, data may remain temporarily in immutable recovery copies until the existing 35-day backup/PITR lifecycle expires. If a recovery copy is restored during that period, the erasure must be re-applied before the restored environment is returned to service.
10. Complaints
You also have the right to lodge a complaint with the competent data-protection supervisory authority. For VOS BV in Belgium, the relevant authority is generally the Belgian Data Protection Authority, subject to the circumstances of your case.
11. Automated decision-making
The current Learn&Gain launch baseline does not rely on automated decision-making that produces legal effects or similarly significant effects on you. Points, streaks and challenge personalization are campaign/service features rather than decisions of that nature.
12. Cookies and external media
Learn&Gain uses necessary browser storage for sign-in, security, referral continuity and core account functionality. We also offer two optional categories controlled through Privacy choices: Analytics / campaign measurement, which allows first-party campaign identifiers and visit/interaction events, and External media, which allows embedded YouTube content to load from YouTube/Google. These optional functions remain inactive until you allow them. You can change your choices later. Ordinary YouTube, LinkedIn and Instagram links do not preload social-platform integrations; the external service is contacted when you follow the link.
13. Changes to this notice
We may update this notice when Learn&Gain functionality, suppliers or data flows change. The current version will be published with its last-updated date.